This should be tuple
Pass user object to ACL check rather than request